SQL select query with form data

Question

I would like to know if there is an alternative to the following(PLEASE NOTE I AM NOT WORRIED ABOUT SECURITY RIGHT NOW)

$value = $_GET['id'];
$query = "SELECT * from users WHERE username = '$value'";

So instead of having $value in apostrophes can we use it in the SQL statements without having to use the apostrophes and use and alternative?

Answer 1

You want to use bind variables. Refer to the documentation for an example (that's an Oracle example, but other DB's should be similar).

Bind variables will also help your application performance with most databases, since the query plan can be reused if you are executing multiple queries of this type.

Since you updated your answer to indicate you were using MySQL, refer here for an example of bind variables for that DB.